verasic-init

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 0.90). The skill explicitly requires relaying full stdout/stderr verbatim (which can include API tokens or secrets) and also instructs users to create/place a GitHub PAT/GH_TOKEN, creating a real risk the agent will output secret values directly.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The listed URLs are mainly raw.githubusercontent.com endpoints used to fetch and (in README) curl|bash a remote setup script and to download Cursor UX files on --yes; fetching and piping remote scripts to a shell or auto-fetching upstream files are legitimate for GitHub-hosted projects but are high-risk distribution vectors if the upstream account or repo is untrusted or compromised.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (high risk: 0.75). The required runtime workflow can fetch cursor UX files via curl from an outsider-controlled origin (raw.githubusercontent.com or VERASIC_INIT_REMOTE_REPO_BASE), and then relays that fetched file content into the agent’s context indirectly through the “repository setup report”/profile actions section that includes stdout/stderr from these operations.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill fetches Cursor UX files at runtime from https://raw.githubusercontent.com/Milkywayrules/verasic-skills/main/cursor/ (via scripts/profile.sh curl calls) which injects upstream UX/agent/rule content into the repo and can directly control agent slash UX and prompts when run with --yes and the cursor/cursor-hybrid profile.